1 Introduction
This Cookie Policy (the "Policy") explains how Kahunas FZE ("Kahunas", "we", "us", or "our") uses cookies and similar tracking technologies (including pixels, tags, beacons, local storage, and software development kits, together "cookies") across our websites, web application, and related services (collectively, the "Services"). It tells you what these technologies are, why we use them, and how you can control them.
This Policy forms part of, and should be read together with, the Kahunas Privacy Policy, which explains how we handle personal data more generally. Where this Policy and the Privacy Policy differ on the processing of personal data, the Privacy Policy governs. Capitalised terms not defined here have the meaning given in the Privacy Policy and the applicable Kahunas user terms.
Kahunas FZE is incorporated in the United Arab Emirates, with its registered office at Coworking Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE. We serve users globally; this Policy applies to all visitors and users of the Services regardless of location.
2 What Cookies Are
A cookie is a small text file placed on your device by a website or application, often containing a unique identifier so the Service can recognise your device on return visits. Similar technologies — such as pixels, tags, software development kits (SDKs), and browser local storage — perform comparable functions and are treated as cookies for the purposes of this Policy.
- Session cookies are temporary and are deleted when you close your browser. They typically support core functions such as navigation and keeping you signed in during a visit.
- Persistent cookies remain on your device after you close your browser, for a defined lifetime or until you delete them. They help us recognise you as a returning user and remember your preferences.
- First-party cookies are set by Kahunas. Third-party cookies are set by our service providers and sub-processors to deliver functions such as authentication, in-app support, and payments.
3 Why We Use Cookies
We use cookies to operate, secure, and improve the Services. Specifically, cookies help us to:
- Keep you signed in and maintain the security of your session
- Remember your settings and preferences, such as language and interface layout
- Process payments securely through our payment providers
- Provide in-app customer support
- Understand how the Services are used so we can measure performance and improve them
- Detect, prevent, and investigate fraud, abuse, and security incidents
4 Categories of Cookies We Use
We group cookies into three categories currently in use on the Services. Strictly necessary cookies are always active because the Services cannot function without them. Functional cookies support preferences and in-app support continuity. The Services do not currently set marketing or advertising cookies.
| Category | Purpose | Status |
|---|---|---|
| Strictly Necessary | Enable core functionality — authentication and sign-in, session management, and security. The Services cannot operate without these. | Always active |
| Functional | Remember your choices and preferences (such as language and layout) and support in-app customer support continuity. Disabling these may degrade parts of the experience. | Set automatically |
The Services do not set marketing or advertising cookies. Analytics and diagnostic technologies in use on the Services are described in Section 6 and are controlled as described in Section 7. If this changes, this Policy will be updated in accordance with Section 10.
5 Cookies on the Platform
The table below sets out the cookies and similar technologies currently used by the Kahunas web application (kahunas.app).
| Cookie | Provider | Category | Purpose | Lifetime |
|---|---|---|---|---|
wos-session | WorkOS | Strictly Necessary | Maintains authenticated user session. HttpOnly, Secure, SameSite=Lax. Although issued with a Max-Age of approximately 400 days, the effective session duration is governed by the WorkOS production session policy (see Section 5.1). | Max-Age: ~400 days (effective maximum: 365 days) |
wos-auth-verifier-* | WorkOS | Strictly Necessary | Temporary authentication verifier used during the login and authentication callback process. Automatically removed after successful authentication. | ~10 minutes |
PARAGLIDE_LOCALE | Kahunas | Functional | Stores the user's preferred language and locale settings. | ~400 days |
k2_list_view | Kahunas | Functional | Remembers the user's preferred client list view. | ~365 days |
sidebar_state | Kahunas | Functional | Remembers whether the navigation sidebar is expanded or collapsed. | ~7 days |
session-* | Gleap | Functional | Maintains continuity for the in-app support widget across visits. | ~365 days |
__vdpl | Kahunas | Strictly Necessary | Pins a browser tab's requests to the application deployment that served it, preventing errors during a version rollout. HttpOnly, SameSite=Strict, set only on document responses. | Max-Age: 24 hours |
The cookie inventory above reflects cookies observed on the Kahunas application (kahunas.app). Payment-provider cookies created during Stripe Checkout or PayPal hosted payment flows are controlled by those providers and are described separately in Section 6.
5.1 Session Duration
User authentication is provided through WorkOS. Although the wos-session cookie is currently issued with a maximum age of approximately 400 days, authentication sessions are governed by the WorkOS production session policy, which currently provides:
- Maximum authenticated session length: 365 days
- Inactivity timeout: 30 days
- Access token lifetime: 5 minutes
Accordingly, these server-side session policies determine the effective duration of authenticated access, regardless of the cookie's stored lifetime.
6 Third-Party Services and Cookies
Kahunas integrates with carefully selected third-party service providers to deliver authentication, infrastructure, observability, customer support, and payment functionality. Depending on how you use the Services, these providers may set cookies or similar technologies. Current providers include:
| Provider | Purpose |
|---|---|
| WorkOS / AuthKit | Authentication, identity management and session handling |
| Vercel Analytics | Website analytics and usage measurement |
| Vercel Speed Insights | Front-end performance monitoring |
| SigNoz | Browser performance monitoring and distributed tracing |
| OpenReplay | Product diagnostics and session replay for troubleshooting |
| Gleap | Customer support widget and in-app support |
| Stripe | Hosted payment checkout |
| PayPal | Payment processing where PayPal is selected |
The Gleap support widget loads certain technologies within its own hosted iframe. These may include Cookiebot, Google Tag Manager, and Cloudflare Real User Monitoring (Cloudflare RUM). These technologies are introduced by Gleap's hosted environment rather than directly by the Kahunas application.
6.1 Payment Provider Cookies
When you purchase subscriptions or services using Stripe Checkout or PayPal, certain cookies may be placed by those providers on their own domains to enable secure payment processing, fraud prevention, and transaction security. These cookies are controlled by the relevant payment provider rather than Kahunas. For further information, please refer to the Stripe Privacy Policy and Cookie Policy, and the PayPal Privacy Statement and Cookie Policy.
The authoritative list of the third parties that may process data through the Services is the Kahunas Sub-Processor List.
7 Consent and Your Choices
Strictly necessary cookies are required for the operation of the Services and are set automatically. For users in the European Economic Area and other jurisdictions where prior consent is required, non-essential cookies and similar technologies, including functional, support, analytics, and diagnostic technologies, are loaded only after you give consent through our consent banner, and you may withdraw consent at any time through the cookie preference centre. For users in the United Kingdom, technologies used solely for statistical purposes, or to adapt the appearance or functionality of the Services to your preferences, are used in reliance on the exceptions in Schedule A1 to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended by the Data (Use and Access) Act 2025); we provide clear information about these technologies in this Policy and a simple, free means to opt out through the cookie preference centre. Any technology that does not fall within a legal exception is used only with your consent.
You may manage or delete cookies through your browser settings as described in Section 8.
8 Managing Cookies in Your Browser
You can manage or delete cookies through your browser settings. Most browsers let you block all cookies, block third-party cookies, delete existing cookies, or alert you when a cookie is set. Blocking strictly necessary cookies may prevent parts of the Services from working correctly. Browser providers publish step-by-step instructions in their respective help centres for Chrome, Safari, Firefox, Edge, and other browsers.
9 Do Not Track and Global Privacy Signals
Some browsers transmit "Do Not Track" (DNT) or Global Privacy Control (GPC) signals. The Kahunas web application does not currently respond differently based solely on these browser signals. Where required by applicable law, Kahunas may implement recognised privacy preference signals in future releases.
10 Changes to This Policy
We may update this Policy from time to time to reflect changes in the technologies we use, our practices, or legal requirements. Material changes will be notified in accordance with the Privacy Policy, for example by website notice, in-app notification, or email. The latest version is always available at https://kahunas.io/cookies. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy.
11 Contact Us
For any questions about this Cookie Policy or our use of cookies, please contact us:
| General Support | support@kahunas.io |
|---|---|
| Privacy & Data Protection | compliance@kahunas.io |
| Postal Address | Kahunas FZE, Customer Support – Data Protection, Coworking Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE |
This Cookie Policy is effective as of 7 September 2026. It supports the Kahunas Privacy Policy; where this Policy and the Privacy Policy differ on the processing of personal data, the Privacy Policy governs.
Appendix A — Version History
The table below records material changes to the Kahunas Cookie Policy. Minor editorial corrections and formatting updates are not recorded. Users are notified of material changes in accordance with Section 10.
Scope of this record. This is the first standalone Kahunas Cookie Policy. Prior to Version 1.0, the use of cookies and tracking technologies was addressed within the Cookies and Tracking section of the Kahunas Privacy Policy.
| Version | Effective Date | Summary of Material Changes |
|---|---|---|
| 1.1 | 7 September 2026 | Added the __vdpl (Vercel Skew Protection) strictly necessary cookie to the Section 5 cookie table. |
| 1.0 | 17 August 2026 | First standalone publication of the Kahunas Cookie Policy. Previously, cookie practices were covered within the Cookies and Tracking section of the Privacy Policy; this version separates them into a dedicated document and commences structured version control. |
For questions regarding changes between versions, contact compliance@kahunas.io.